lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20120622143435.c1ba744e.akpm@linux-foundation.org>
Date:	Fri, 22 Jun 2012 14:34:35 -0700
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	Kees Cook <keescook@...omium.org>
Cc:	linux-kernel@...r.kernel.org, Alan Cox <alan@...ux.intel.com>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Alexander Viro <viro@...iv.linux.org.uk>,
	Rob Landley <rob@...dley.net>, Ingo Molnar <mingo@...hat.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Doug Ledford <dledford@...hat.com>,
	Marcel Holtmann <marcel@...tmann.org>,
	Serge Hallyn <serge.hallyn@...onical.com>,
	Joe Korty <joe.korty@...r.com>,
	David Howells <dhowells@...hat.com>,
	James Morris <james.l.morris@...cle.com>,
	linux-doc@...r.kernel.org, linux-fsdevel@...r.kernel.org
Subject: Re: [PATCH v3] fs: introduce pipe-only dump mode suid_dumpable=3

On Fri, 22 Jun 2012 14:09:28 -0700
Kees Cook <keescook@...omium.org> wrote:

> On Fri, Jun 22, 2012 at 12:55 PM, Andrew Morton
> <akpm@...ux-foundation.org> wrote:
> > On Fri, 22 Jun 2012 12:24:13 -0700
> > Kees Cook <keescook@...omium.org> wrote:
> >
> >> The value
> >> of suid_dumpable=2 is now historic, and attempting to set this sysctl
> >> value returns -EINVAL.
> >
> > This sounds a bit harsh - will it not cause existing configurations to
> > immediately break? __If so, would it not be better to retain the =2 mode
> > for a while, and emit a nice warning when it is set?
> 
> I view it as a security vulnerability, so I'd rather see it
> eliminated. I see "=1" as a security vulnerability too, but at least
> that's well-known to be a bad idea. The "=2" mode has been assumed to
> be safe, but it isn't.

But what will be the effects of the change?  People's initscripts do an
"echo 2" which fails and the error message (if any) won't get logged
anywhere where anyone looks.  So now their machine is bumbling along in
the wrong mode and much later on, someone notices that coredumps are
going awry?  This is not exactly a user-friendly way of rolling out
kernel API changes!

And how serious is the security vulnerability, in real-world terms? 
Serious enough to risk this amount of bustage?

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ